CVE-2026-4360 Tarfile.extract() doesn't fully respect filter parameter

🗓️ 30 Jun 2026 14:45:35Reported by GoogleType

osv🔗 osv.dev👁 2 Views

Tarfile.extract does not pass filter for hardlinks, risking unexpected uid and gid when extracting untrusted tar files.

Reporter	Title	Published	Views	Family All 19
ATTACKERKB	CVE-2026-4360	30 Jun 202614:45	–	attackerkb
Circl	CVE-2026-4360	2 Jul 202608:09	–	circl
CVE	CVE-2026-4360	30 Jun 202614:45	–	cve
Cvelist	CVE-2026-4360 Tarfile.extract() doesn't fully respect filter parameter	30 Jun 202614:45	–	cvelist
Debian CVE	CVE-2026-4360	30 Jun 202614:45	–	debiancve
EUVD	EUVD-2026-40336	30 Jun 202614:45	–	euvd
NVD	CVE-2026-4360	30 Jun 202615:16	–	nvd
OSV	BELL-CVE-2026-4360	4 Jul 202606:04	–	osv
OSV	BIT-LIBPYTHON-2026-4360 Tarfile.extract() doesn't fully respect filter parameter	8 Jul 202611:31	–	osv
OSV	BIT-PYTHON-2026-4360 Tarfile.extract() doesn't fully respect filter parameter	8 Jul 202611:36	–	osv

Source	Link
github	www.github.com/CVEProject/cvelistV5/tree/main/cves/2026/4xxx/CVE-2026-4360.json
mail	www.mail.python.org/archives/list/[email protected]/thread/TWZW2PC2AZOV6FENIHFSRC63OM7MBGSB/
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-4360
github	www.github.com/python/cpython/issues/151987
github	www.github.com/python/cpython/commit/5e0ef3f1afe892e4f64eb83368db57ac4c40cba0
github	www.github.com/python/cpython/commit/7b57e8d51446297b8c7c482d224bc5f1938e4301
github	www.github.com/python/cpython/commit/7ccdbaba2c54250a70d7f25632152df7655a5e0a
github	www.github.com/python/cpython/commit/d2b2f5eacab4dd48446b63340613b05dcbbf0b44
github	www.github.com/python/cpython/commit/eee3ddf0ca10283cc7fea724aae9cd8665f8d15e
github	www.github.com/python/cpython/pull/151988

10 Jul 2026 04:02Current

5.9Medium risk

Vulners AI Score5.9

CVSS 42

EPSS0.00235